Cybercrime intelligence at the core

See earlier. Act with context.

Identify business fraud, external digital risk and API security risk earlier, then turn relevant evidence into decisions through product platforms, risk data and professional services.

Talk to our team Explore solutions

Product platforms · Risk data · Professional services

01Risk signals02Connected context03Actionable evidence

Threat Hunter product interface showing high-value intelligence with redacted demonstration data — 01Risk signals02Connected context03Actionable evidence

Start with the problem

Which risk does your team need to control?

Begin with the business condition you recognize, then see the product, data and specialist components that fit.

All solutions

Business fraud

Business Fraud Protection

See how fraud is being prepared outside your systems, connect related activity and strengthen the controls protecting critical workflows.

See attack preparationValidate critical controls

Credit fraud

Credit Fraud Protection

Bring external fraud intelligence into application, approval and post-loan work to identify organized behavior that isolated applications may hide.

Monitor intermediaries and groupsFollow changes over time

Financial risk control

China Fraud-Linked Fund Risk Sensing

External risk context on accounts, customers and merchants along the fraud-linked fund chain, for institutions operating in mainland China.

Sense receiving-account riskIdentify laundering merchants and corporate accounts

Data leakage

Data Leakage Detection and Response

Find enterprise, employee and customer data beyond the organization’s boundary, verify what matters and move confirmed risks into response.

Find relevant exposureMove confirmed risks into response

Phishing & impersonation

Phishing, Impersonation and Brand Protection

Discover digital objects that imitate your official presence, verify the threat and coordinate a traceable response.

Discover suspected impersonationCoordinate a traceable response

Account takeover

Account Takeover and Credential Exposure Protection

Find externally exposed credentials, match relevant accounts within an authorized scope and support proportionate account protection.

Find credential exposureSupport proportionate protection

Global business risk

Global Business Risk Protection

Give cross-market registration, account, payment and promotion teams risk context that reflects local resources and evolving fraud methods.

Start with the target marketValidate market-specific controls

View all 7 solutions

Products & services

Three operating models for different risk tasks

Platforms support continuous operations, risk data informs decisions, and professional services address defined specialist tasks.

View products & services

Product Platforms

Continuous visibility and operational workflows for recurring risk.

Anti-Fraud Intelligence PlatformTrack external fraud resources, tools, channels and organized activity before they surface as isolated account or transaction events.SWARM RADAR | Coordinated BehaviorIdentify coordinated activity around a public incident, trace related clusters and deliver reviewable investigation evidence.Data Leakage Intelligence PlatformContinuously identify enterprise, employee and customer data exposed, distributed or traded beyond the organization’s boundary.Phishing & Brand Impersonation Intelligence PlatformContinuously discover suspicious domains, sites, apps and social accounts that imitate official customer touchpoints.Account Takeover Intelligence PlatformMonitor external credential exposure and match relevant accounts within the customer’s authorized scope.API Security PlatformContinuously discover changing API assets, map sensitive-data flows and identify interface defects from mirrored traffic.

Risk Data

Explainable external signals for real-time decisions and investigations.

Phone Number Risk IntelligenceAdd explainable external risk context to phone numbers used in registration, login, promotion, transaction and credit workflows.IP Risk IntelligenceExplain the network environment behind an IP address, including relevant proxy, hosting and external abuse context.Email Risk IntelligenceAdd email-type, external exposure and relevant risk context to identity and account decisions.Mainland China Bank Card Risk IntelligenceAdd external gambling, fraud and money-laundering risk signals to bank-card review in mainland China.Global Compromised Card IntelligenceAdd external card-exposure signals to cross-border payment, card-testing, fraud and chargeback workflows.

Professional Services

Expert validation and response for clearly scoped risk objectives.

Credit Fraud Intelligence ServiceInvestigate external fraud intermediaries, identity packaging, fraudulent channels and organized activity across the credit lifecycle.Anti-Fraud Blue Team Validation ServiceTest whether agreed business controls protect critical objectives in realistic domestic or international fraud scenarios.Digital Risk Takedown & Response ServiceVerify external digital risks, preserve evidence, coordinate removal and track recurrence across the agreed response scope.

How intelligence supports action

From detecting risk to sustaining the response

This is a shared operating method across offerings, not a claim that every product includes the same service or response action.

Detect

Keep external risk signals visible

Observe changes connected to business workflows, identities, brands, data and external attack activity.

Understand

Connect evidence to impact

Organize risk objects, match rationale, relationships and necessary context so teams can judge priority.

Act

Move findings into the right workflow

Support strategy, review, investigation, account protection, response and governance decisions.

Track

Follow what changes next

Keep risk status, recurrence and material changes visible for sustained operations.

Industry researchGartner · IDC

Included in relevant public industry research

Delivery networkTwo DRRCs

Digital risk response centers in Shenzhen and Chongqing

Service foundation24 × 7 × 365

Continuous risk monitoring and response foundation

Market experienceGlobal customers

Experience across Europe, the Americas and Southeast Asia

Selected customers

Trusted across high-stakes digital operations

Threat Hunter works with teams across financial services, internet platforms, commerce and consumer businesses. Selected customer brands are shown with authorization.

Threat research

Turn frontline observations into reusable judgment

Explore selected public research on the threat economy, digital risk and changing attack patterns.

Explore research

Featured research · Threat Research

Fraud Fund Chains in Underground Operations: Divergent Bank-Account Risk Patterns, and Fraud Proceeds Mixed into Merchant Settlement Flows

Threat Hunter continuously monitors fraud-related fund activity by underground operators. In the January–October 2026 monitoring window, it identified more than 64,000 fraud-related transfers, involving about RMB 660 million. Mobile banking accounted for approximately 67.37% of those transfers by count. Risk merchants spanned more than 80 industries; among the acquirers linked to those merchants, bank acquirers accounted for about 41.12%. This report examines risk characteristics across the upstream, midstream, and downstream stages of fund flows—channel mix, account-party structure, and merchant acquiring—and offers a reference for financial institutions seeking to identify fraud fund chains.

Read the publication

Threat Research

October 2026 Report on Malicious Water-Army Attacks Against Brands

Threat Hunter analyzed 651 brand water-army attack activities identified between 1 and 30 October 2026. The attacks involved multiple industries, including maternity and infant, beauty and personal care, and digital products. This report examines the distribution of targeted brands and industries, typical attack narratives, and the way comments are expressed—showing how water-army activity can influence consumers’ brand perceptions and purchase choices, and offering a reference for companies seeking to identify and respond to organized malicious attacks.

Business security research

The Shadow Sales Channel

A method brief on verifying subscription resale, understanding seller replacement economics and a measured account-level response.

Start with the business risk

See the risk earlier. Move the right evidence into action.

Tell us what is happening, which workflow is affected and what your team already observes. We will help define a practical next step.

Talk to our team